Dockerfile best practices

Enforces non-root user execution and UIDs above 10,000 to mitigate privilege escalation risks, backed by references to Docker docs and Bitnami's security analysis.

Provides a ready-to-copy Dockerfile with detailed comments derived from real-world experience at companies like Sourcegraph, saving setup time and reducing common errors.

Recommends major.minor image tags to receive security updates while maintaining stability, and suggests tools like docker-lock for reproducibility without manual SHA tracking.

Integrates tini as the ENTRYPOINT to ensure proper signal processing and prevent zombie processes, even in environments like Kubernetes where Docker's --init is not default.